ClawHub
Back to skill

Security audit

ernie-integration

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only skill for configuring Baidu ERNIE in Clawdbot, with expected external API use and some credential-handling cautions.

Install only if you intend to use Baidu Qianfan as a model provider. Prefer a secret manager or a tightly permissioned local secrets file over placing the API key directly in shell startup files, and avoid running commands that print the full key in shared terminals, logs, screenshots, or support transcripts.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:37
Finding

Persistent Plaintext Storage and Terminal Disclosure of API Credentials

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:37-41, SKILL.md:157-161, README.md:25-29, README.md:134-138, and references/config-examples.md:128-136
Vulnerability Type: Plaintext credential storage and sensitive information exposure
Risk Level: Medium

Vulnerable Code

SKILL.md:37-41:

bash
export ERNIE_API_KEY="bce-v3/ALTAK-your-key-here"
source ~/.zshrc  # or source ~/.bashrc

SKILL.md:157-161:

bash
echo $ERNIE_API_KEY

README.md:25-29:

bash
export ERNIE_API_KEY="bce-v3/ALTAK-your-key-here"

README.md:134-138:

bash
# Verify API key
echo $ERNIE_API_KEY

references/config-examples.md:128-136:

bash
export ERNIE_API_KEY="bce-v3/ALTAK-your-key-here"

Then reload:

bash
source ~/.bashrc  # or source ~/.zshrc

Technical Analysis

The documentation directs users to place the Qianfan API key directly in a shell startup file such as ~/.bashrc or ~/.zshrc. This retains the credential in plaintext across sessions. Any process or account capable of reading the user's profile can recover the complete credential.

The troubleshooting instructions additionally use echo $ERNIE_API_KEY, which prints the complete secret to the terminal. The value may consequently be exposed through terminal recordings, scrollback, screenshots, copied support transcripts, CI output, remote-session logging, or other command-output capture mechanisms.

Although the examples use an obvious placeholder rather than a real embedded key, users are explicitly expected to replace it with a live credential. The vulnerable behavior therefore occurs when the documented procedure is followed.

Attack Path

  1. A user follows the integration instructions and stores a valid Qianfan API key in a shell startup file.
  2. The user later runs echo $ERNIE_API_KEY while troubleshooting.
  3. An attacker or unintended observer obtains the credential ...[truncated 973 chars]
Remediation
View remediation

Remediation Suggestions

  1. Recommend an operating-system credential manager, dedicated secret manager, or platform-supported credential facility instead of placing the key directly in shell startup files.

  2. If file-based storage is unavoidable, use a dedicated secrets file outside the repository, restrict it to the owning user with mode 0600, and load it only for the process that requires the credential.

  3. Replace echo $ERNIE_API_KEY with a presence check that does not reveal the value:

    bash
    if [ -n "${ERNIE_API_KEY:-}" ]; then
  printf '%s\n' "ERNIE_API_KEY is set"
else
  printf '%s\n' "ERNIE_API_KEY is not set"
fi

  4. If partial identification is necessary, display only a small redacted prefix or fingerprint and never print the complete credential.

  5. Warn users not to include secrets in screenshots, issue reports, support transcripts, CI logs, or recorded terminal sessions.

  6. Advise immediate revocation and rotation if a key has already appeared in terminal captures or other retained output.

  7. Preserve the existing guidance against committing credentials to version control, and supplement it with secret-scanning and pre-commit checks.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 151)May include surrounding context.

Test endpoint directly:

bash
curl -X POST "https://qianfan.baidubce.com/v2/chat/completions" \
  -H "Authorization: Bearer $ERNIE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "ernie-5.0-thinking-preview", "messages": [{"role": "user", "content": "test"}]}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 173)May include surrounding context.

Test endpoint directly:

bash
curl -X POST "https://qianfan.baidubce.com/v2/chat/completions" \
  -H "Authorization: Bearer $ERNIE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "ernie-5.0-thinking-preview", "messages": [{"role": "user", "content": "test"}]}'

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md
1. Visit https://console.bce.baidu.com/qianfan/ais/console/applicationConsole/application
2. Register a Baidu Cloud account if you don't have one
3. Navigate to the API Keys section
4. Create a new API key
5. Copy the key (format: `bce-v3/ALTAK-...`)

**Note:** The API key uses Baidu's BCE authentication format.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/config-examples.md (reported line 158)May include surrounding context.

Test API connection

bash
curl -X POST "https://qianfan.baidubce.com/v2/chat/completions" \
  -H "Authorization: Bearer $ERNIE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown file includes a troubleshooting command that tells users to run echo $ERNIE_API_KEY, which will print the full credential to the terminal. The README does not warn users that this reveals sensitive secret material on screen and potentially in shell history, recordings, or logs.

Content

No source excerpt is available for this finding.